PT-2025-51930 · Churchcrm · Churchcrm

Uartu0 · Published 2025-12-17 · Updated 2025-12-20 · CVE-2025-68112

Positive Technologies (AI Summary)

CVSS v3.1

9.6

Critical

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions ChurchCRM versions prior to 6.5.3

Description ChurchCRM is an open-source church management system. A SQL injection flaw exists in the Event Attendee Editor. This allows authenticated users to execute arbitrary SQL commands, potentially leading to complete database compromise, administrative credential theft, and system takeover. Attackers could extract sensitive member data, authentication credentials, and financial information. The vulnerable component is the Event Attendee Editor. SQL injection is a code injection technique used to attack data-driven applications, in which malicious SQL statements are inserted into an entry field for execution.

Recommendations Upgrade to version 6.5.3 to address this issue.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2025-68112

GHSA-HXF4-3VHP-WQCQ

Affected Products

Churchcrm

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/68xxx/CVE-2025-68112.json · Exploit
• 🔥 https://github.com/ChurchCRM/CRM/security/advisories/GHSA-hxf4-3vhp-wqcq · Exploit
• https://osv.dev/vulnerability/CVE-2025-68112 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-68112 · Security Note
• https://twitter.com/CveFindCom/status/2001421954415276261 · Twitter Post
• https://twitter.com/CVEnew/status/2002487816270541003 · Twitter Post
• https://twitter.com/TheHackerWire/status/2001421324267520370 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2001454891630244043 · Twitter Post